Re: [PATCH] serial: core: Fix a NULL pointer dereference in uart_parse_earlycon()

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Aug 06, 2026 at 02:10:11PM +0800, Xiaochun Li wrote:
> console=uart and console=pl011 can reach the preferred console matching
> path without an options field when a comma is absent from the command
> line. In that case uart_parse_earlycon() receives a NULL pointer and
> immediately passes it to strncmp(), which triggers a NULL pointer
> dereference during console matching.
> 
> Address this by returning -EINVAL when the options pointer is missing,
> ensuring incomplete console arguments are cleanly rejected while
> preserving the behavior of all valid earlycon-style command lines.
> 
> Fixes: 73abaf87f01b ("serial: earlycon: Refactor parse_options into serial core")
> Signed-off-by: Xiaochun Li <lixiaochun@open-hieco.net>
> ---
>  drivers/tty/serial/serial_core.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index a530ad372b43..02e770bf8bf6 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
> @@ -2084,7 +2084,8 @@ EXPORT_SYMBOL_GPL(uart_console_write);
>  
>  /**
>   * uart_parse_earlycon - Parse earlycon options
> - * @p:	     ptr to 2nd field (ie., just beyond '<name>,')
> + * @p:	     ptr to 2nd field (ie., just beyond '<name>,'); %NULL if
> + *	     no console options were supplied
>   * @iotype:  ptr for decoded iotype (out)
>   * @addr:    ptr for decoded mapbase/iobase (out)
>   * @options: ptr for <options> field; %NULL if not present (out)
> @@ -2104,6 +2105,9 @@ EXPORT_SYMBOL_GPL(uart_console_write);
>  int uart_parse_earlycon(char *p, enum uart_iotype *iotype,
>  			resource_size_t *addr, char **options)
>  {
> +	if (!p)
> +		return -EINVAL;
> +
>  	if (strncmp(p, "mmio,", 5) == 0) {
>  		*iotype = UPIO_MEM;
>  		p += 5;
> -- 
> 2.52.0
> 
> 

How was this tested?